RHBA-2019:0326 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.82 is now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.82. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2019:0327

Space precludes documenting all of the bug fixes in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages.

Solution

Before applying this update, ensure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.82, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1506736 - Misleading error messages in Heapster log when namespace deleted - Hawkular returns 500 to Heapster
• BZ - 1598822 - RFE - A 'openshift_node_upgrade_pre_drain_hook' hook available during install / upgrade
• BZ - 1615719 - easy-mode-upload.yaml playbook fails for source file not exist
• BZ - 1623338 - Misunderstanding about svc hostname from Webconsle
• BZ - 1634302 - KubePersistentVolumeUsageCritical/KubePersistentVolumeFullInFourDays should regex check exported_namespace not namespace
• BZ - 1635254 - [3.11] uninstall will remove the all the docker related files and reinstall on the same cluster fails
• BZ - 1635613 - oc_adm_router doesn't create router-metrics-tls secret
• BZ - 1642379 - Undefined variable openshift_version in openstack playbooks
• BZ - 1642929 - During OpenShift Install (/usr/share/ansible/openshift-ansible/playbooks/openstack/openshift-cluster/install.yml), the playbook fails at task "Enable RHEL repositories" with error "'openshift_version' is undefined"
• BZ - 1651090 - 404 errors on web console
• BZ - 1651632 - cluster console is not accessible from web console
• BZ - 1655183 - Certificate expiry checks fail when `openshift_is_atomic` is undefined
• BZ - 1657019 - 3.11 control plain upgrade upgrades the ovs and sdn pods on all node network causing downtime on the nodes
• BZ - 1659194 - Conntrack rule for UDP traffic is not removed when using NodePort
• BZ - 1659441 - Port range from 9000-10000 need to be opened from iptables explicitly after upgrading from 3.10 to 3.11
• BZ - 1659653 - WaitForAttach failed for VMDK devicePath is empty
• BZ - 1659976 - Default storage class shows false even it is true
• BZ - 1660598 - HostAlreadyClaimed route issue on path based route
• BZ - 1664753 - Service Catalog readiness probe should be split from liveness probe
• BZ - 1665235 - Clarify logging-es cluster restart message
• BZ - 1666820 - [3.11] [vsphere] The "Internal IP/Host IP" of the infra nodes starts changing to the VIPs, and changes constantly/randomly all on its own, to any of these VIPs on eth0 ( confirmed by oc get hostsubnet output).
• BZ - 1667270 - openshift-ansible fails on openstack without floating IPs
• BZ - 1667618 - Running example other certificate expiration playbooks are failed due to missing "openshift_is_atomic"
• BZ - 1668412 - [3.11] When using the oc new-app to create a new build, the builds are creating incomplete multipart uploads to S3 and incomplete uploads are not cleaned automatically
• BZ - 1668828 - installation fails with PV annotations missing
• BZ - 1668970 - Router does not properly concatenate certificates generated by Red Hat IdM due to missing nonprintable ('\n')
• BZ - 1669019 - Check for file paths outside of /etc/origin/master in master's config fails on auditConfig.policyConfiguratio
• BZ - 1669194 - Sanity Check in upgrade and prerequisite playbook is slow and removed vars check does not work
• BZ - 1669439 - When running upgrade playbook, received the error: 'UnicodeEncodeError: 'ascii' codec can't encode character u'\\xfc' in position 1: ordinal not in range (128)'
• BZ - 1669555 - Sync Pod script does not copy volume-config.yaml to node
• BZ - 1669984 - 'hardware_handler "1 alua" ' missing from multipath.conf file
• BZ - 1670551 - oc image mirror fails with error 'tag: unexpected end of JSON input' when trying to mirror image from Red Hat registry.
• BZ - 1673178 - node-exporter and kube-state metrics pods in CrashLoopBackOff

CVEs

• CVE-2018-20102
• CVE-2018-20103
• CVE-2018-20615
• CVE-2018-1000865
• CVE-2018-1000866
• CVE-2019-3826
• CVE-2019-1003000
• CVE-2019-1003001
• CVE-2019-1003002
• CVE-2019-1003003
• CVE-2019-1003004
• CVE-2019-1003010
• CVE-2019-1003011
• CVE-2019-1003012
• CVE-2019-1003013
• CVE-2019-1003014

References

(none)